The invention finds particular application in securing a computer against corruption of data on its mass storage device by malicious programs such as so-called "trojan" or "virus" programs.
Most personal computers are equipped with one or more hard disk drives. These typically store between ten and several hundred megabytes of information, and are the computer's prime, and often only, large-scale permanent program and data store. As such, they are prime targets for attack by malicious programs.
There has recently been a dramatic rise in the incidence of "trojan" or "virus" programs. These are programs designed to destroy data on a computer system by erasing or modifying data stored on the computer's disk drives. They are often embedded in otherwise legitimate and useful programs. These programs are usually acquired by a computer user by copying public domain or shareware programs, or are intentionally placed on a host computer by someone wanting to destroy data on that system.
Virus programs may lie dormant for some time before being triggered, e.g. after a certain number of accesses, after a certain time, on a given date, or on some other trigger event. During the time that the virus is dormant it may attempt to reproduce itself on other disks or disk drives, thereby spreading itself further. The viruses on these copies will also remain dormant and not reproduce until triggered.
When the virus is triggered, it attempts to interfere with the computer's operation. One way it does this is to destroy data stored in the computer's disk drive memory. There are many ways of doing this, ranging from erasing or modifying individual files, erasing or modifying the disk's directory to prevent the computer from locating files, or completely erasing (re-formatting) the computer's disk drive.
It is an object of the present invention to secure a computer against undesired write operations to, or read operations from, a mass storage device of the computer.